Tag:request-smuggling

All the articles with the tag "request-smuggling".

• CVE-2026-69243 PoC: aiohttp request smuggling through a rejected WebSocket upgrade

  Published date: 4 Aug, 2026

  8 min read

  I reproduced the aiohttp parser bug end to end: a rejected WebSocket upgrade leaves the request body in the parser tail, and through the standard Nginx WebSocket map it becomes CWE-444 smuggling that bypasses a deny-all edge ACL. PoC in Python and Rust, plus lab-validated detection.

  • #request-smuggling
  • #http
  • #aiohttp
  • #rust